CVE-2026-23800 Critical Privilege Escalation in Modular DS modular-connector

CVE-2026-23800 is a critical (CVSS 10.0) CWE-266 Incorrect Privilege Assignment vulnerability in Modular DS’s modular-connector component affecting versions 2.5.2 up to (but not including) 2.6.0. The issue is described as enabling remote privilege escalation with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N, with scope change), with potential for full impact to confidentiality, integrity, and availability. Public tracking pages also reference external records (e.g., NVD) and third-party writeups (e.g., Patchstack) for additional context and remediation guidance.

Threat-intelligence commentary notes that, despite the severity and apparent ease of exploitation, no public exploits were reported as available at the time of disclosure, increasing the importance of rapid patching/upgrade planning and monitoring for exploitation attempts. Other items in the provided material—such as a Rapid7 Metasploit weekly wrap-up covering unrelated modules and a separate Android-related information disclosure CVE—do not describe this Modular DS vulnerability and should not be treated as part of the same incident narrative.